T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:4
- Finding
- Unpinned Third-Party Package Installation Creates Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md:4` and `SKILL.md:85-88` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium **Vulnerable Code Snippet**: ```yaml metadata: {"openclaw":{"emoji":"📋","requires":{"bins":["tdnet-disclosure-mcp"]},"install":[{"id":"uv","kind":"uv","package":"tdnet-disclosure-mcp","bins":["tdnet-disclosure-mcp"],"label":"Install tdnet-disclosure-mcp (uv)"}],"tags":["japan","finance","tdnet","disclosure","earnings","stock","jpx","tse","mcp"]}} ``` ```markdown ## Setup - No API key required - Python package: `pip install tdnet-disclosure-mcp` or `uv tool install tdnet-disclosure-mcp` - Data source: Yanoshin Web API (mirrors TDNET data) ``` ### Technical Analysis The Skill directs the environment to install and execute the external `tdnet-disclosure-mcp` Python package without specifying an exact version, integrity hash, lockfile, trusted repository URL, or verified publisher identity. Consequently, `pip` or `uv` resolves whichever release is current at installation time. The project contains only `SKILL.md`; it does not include the package implementation or other executable source that would allow its runtime behavior to be audited. The reviewed content does not establish that the current package is malicious. However, the installation mechanism leaves the effective executable dependency mutable after review and exposes users to compromised publisher accounts, malicious future releases, package-index compromise, or dependency-resolution attacks. Python packages may execute code during installation depending on their build configuration and will execute package-controlled code when the installed command is invoked. ### Attack Path 1. An attacker compromises the package publisher account, distribution channel, or a dependency used by `tdnet-disclosure-mcp`, or publishes a malicious future release. 2. The attacker distributes a modified package v ...[truncated 1058 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the package to an exact, reviewed version in both Skill metadata and setup commands, such as `tdnet-disclosure-mcp==X.Y.Z`. 2. Require cryptographic artifact hashes through a hash-locked requirements file or equivalent package-manager lockfile. 3. Document the canonical source repository, expected package-index namespace, and verified publisher identity. 4. Review the pinned package source and its complete transitive dependency tree before publication. 5. Use a private or controlled package mirror where feasible and permit only approved artifacts. 6. Perform installation and execution in a sandbox with minimal filesystem, credential, and network access. 7. Add automated dependency monitoring and require a new security review before updating the pinned version.